File name:

invoice_2318362983713_823931342io.pdf.exe

Full analysis: https://app.any.run/tasks/661c4f39-c453-4dba-8781-cab801169224
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 03, 2024, 01:48:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
zeroaccess
evasion
loader
geo
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

EA039A854D20D7734C5ADD48F1A51C34

SHA1:

9615DCA4C0E46B8A39DE5428AF7DB060399230B2

SHA256:

69E966E730557FDE8FD84317CDEF1ECE00A8BB3470C0B58F3231E170168AF169

SSDEEP:

6144:tg+buboEf6ZsYxQWzMTohPdrDdkyRcpD7r:GmubXyQWQToDrDnED7r

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was injected by another process

      • explorer.exe (PID: 932)
      • services.exe (PID: 468)

    • Changes the autorun value in the registry

      • invoice_2318362983713_823931342io.pdf.exe (PID: 116)
      • services.exe (PID: 468)

    • ZEROACCESS has been detected (SURICATA)

      • invoice_2318362983713_823931342io.pdf.exe (PID: 116)
      • InstallFlashPlayer.exe (PID: 188)

    • ZEROACCESS has been detected

      • invoice_2318362983713_823931342io.pdf.exe (PID: 116)

    • Runs injected code in another process

      • InstallFlashPlayer.exe (PID: 188)
      • invoice_2318362983713_823931342io.pdf.exe (PID: 116)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • invoice_2318362983713_823931342io.pdf.exe (PID: 116)

    • Reads the Internet Settings

      • invoice_2318362983713_823931342io.pdf.exe (PID: 116)
      • InstallFlashPlayer.exe (PID: 188)

    • Checks for external IP

      • invoice_2318362983713_823931342io.pdf.exe (PID: 116)

    • Starts CMD.EXE for commands execution

      • invoice_2318362983713_823931342io.pdf.exe (PID: 116)
      • InstallFlashPlayer.exe (PID: 188)

    • Process requests binary or script from the Internet

      • invoice_2318362983713_823931342io.pdf.exe (PID: 116)

    • Potential Corporate Privacy Violation

      • invoice_2318362983713_823931342io.pdf.exe (PID: 116)

    • Reads security settings of Internet Explorer

      • invoice_2318362983713_823931342io.pdf.exe (PID: 116)
      • InstallFlashPlayer.exe (PID: 188)

    • Detected use of alternative data streams (AltDS)

      • InstallFlashPlayer.exe (PID: 188)
      • services.exe (PID: 468)

    • Executable content was dropped or overwritten

      • InstallFlashPlayer.exe (PID: 188)
      • invoice_2318362983713_823931342io.pdf.exe (PID: 116)

    • Creates or modifies Windows services

      • InstallFlashPlayer.exe (PID: 188)

    • Write to the desktop.ini file (may be used to cloak folders)

      • services.exe (PID: 468)

    • There is functionality for lookup Geolocation (YARA)

      • InstallFlashPlayer.exe (PID: 188)

  • INFO

    • The process uses the downloaded file

      • invoice_2318362983713_823931342io.pdf.exe (PID: 116)
      • explorer.exe (PID: 932)

    • Create files in a temporary directory

      • invoice_2318362983713_823931342io.pdf.exe (PID: 116)

    • Reads the computer name

      • invoice_2318362983713_823931342io.pdf.exe (PID: 116)
      • InstallFlashPlayer.exe (PID: 188)
      • wmpnscfg.exe (PID: 660)

    • Creates files in the program directory

      • InstallFlashPlayer.exe (PID: 188)
      • services.exe (PID: 468)

    • Checks supported languages

      • InstallFlashPlayer.exe (PID: 188)
      • wmpnscfg.exe (PID: 660)
      • invoice_2318362983713_823931342io.pdf.exe (PID: 116)

    • Checks proxy server information

      • InstallFlashPlayer.exe (PID: 188)

    • Reads the machine GUID from the registry

      • InstallFlashPlayer.exe (PID: 188)
      • invoice_2318362983713_823931342io.pdf.exe (PID: 116)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 660)
      • explorer.exe (PID: 1600)

    • Reads the Internet Settings

      • explorer.exe (PID: 932)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 932)

    • Creates files or folders in the user directory

      • invoice_2318362983713_823931342io.pdf.exe (PID: 116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:11:25 10:32:03+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 144384
InitializedDataSize: 107520
UninitializedDataSize: -
EntryPoint: 0xa3b6
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
9
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZEROACCESS invoice_2318362983713_823931342io.pdf.exe #ZEROACCESS installflashplayer.exe cmd.exe no specs wmpnscfg.exe no specs explorer.exe no specs cmd.exe no specs Shell Security Editor no specs services.exe explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\AppData\Local\Temp\invoice_2318362983713_823931342io.pdf.exe" C:\Users\admin\AppData\Local\Temp\invoice_2318362983713_823931342io.pdf.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\invoice_2318362983713_823931342io.pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
188"C:\Users\admin\AppData\Local\Temp\InstallFlashPlayer.exe" C:\Users\admin\AppData\Local\Temp\InstallFlashPlayer.exe
invoice_2318362983713_823931342io.pdf.exe
User:
admin
Company:
Adobe Systems, Inc.
Integrity Level:
HIGH
Description:
Adobe® Flash® Player Installer/Uninstaller 11.0 r1
Exit code:
0
Version:
11,0,1,152
Modules
Images
c:\users\admin\appdata\local\temp\installflashplayer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
448"C:\Windows\system32\cmd.exe"C:\Windows\System32\cmd.exe—invoice_2318362983713_823931342io.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
4294967295
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
468C:\Windows\system32\services.exeC:\Windows\System32\services.exe
wininit.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Services and Controller app
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\services.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\profapi.dll
c:\windows\system32\sechost.dll
c:\windows\system32\cryptbase.dll
660"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
688"C:\Windows\system32\cmd.exe"C:\Windows\System32\cmd.exe—InstallFlashPlayer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
4294967295
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
932C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\invoice_2318362983713_823931342io.pdf.exe
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1312C:\Windows\system32\DllHost.exe /Processid:{4D111E08-CBF7-4F12-A926-2C7920AF52FC}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1600"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 758
Read events
1 525
Write events
114
Delete events
119

Modification events

(PID) Process:(932) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB0100000056DF4816800E214088F2CA6FD8F1B3DC0000000002000000000010660000000100002000000035041317F9D31FEAE92D1C87B4719867C696F6DE0EF1E68C7E8E27E72B37E79D000000000E8000000002000020000000B587FE4F9818FB2A2D34175C037D1B63D5BC9E009BFEEAE923C7DCC1C50DF87230000000D28369378C825370E7FA663F3F3DBBAA71C6DF0B210FB0E9E1F5AEE357A0B9818D14B7741FC12BADDC806047C984F39C40000000B9CAB7DED65D0C416D58D3339C4D025468D65E2FCBA72938DE02E917E2B4E99E7EA02BBF8281ED3A2A30AC565873AFE35119E753699977582A99DF901F646ED9
(PID) Process:(116) invoice_2318362983713_823931342io.pdf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Google Update
Value:
"C:\Users\admin\AppData\Local\Google\Desktop\Install\{6c5bc945-ecdc-d004-f972-a3d5e5911bb1}\❤≸⋙\Ⱒ☠⍨\‮ﯹ๛\{6c5bc945-ecdc-d004-f972-a3d5e5911bb1}\GoogleUpdate.exe" >
(PID) Process:(116) invoice_2318362983713_823931342io.pdf.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(116) invoice_2318362983713_823931342io.pdf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(116) invoice_2318362983713_823931342io.pdf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(116) invoice_2318362983713_823931342io.pdf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(116) invoice_2318362983713_823931342io.pdf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(188) InstallFlashPlayer.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinDefend\Parameters
Operation:delete keyName:(default)
Value:
(PID) Process:(188) InstallFlashPlayer.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinDefend\Security
Operation:delete keyName:(default)
Value:
(PID) Process:(188) InstallFlashPlayer.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo\0
Operation:delete keyName:(default)
Value:
Executable files
5
Suspicious files
2
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
116invoice_2318362983713_823931342io.pdf.exeC:\Users\admin\AppData\Local\Google\Desktop\Install\{6c5bc945-ecdc-d004-f972-a3d5e5911bb1}\❤≸⋙\Ⱒ☠⍨\‮ﯹ๛\{6c5bc945-ecdc-d004-f972-a3d5e5911bb1}\@binary
MD5:B6E9CCC417B9F8ADBDF19834F69571E5
SHA256:C4A3C1FBD7A17F9091B8B3812FAB75EBE95F295497FE0C65B1D9304CC39A810B
116invoice_2318362983713_823931342io.pdf.exeC:\Users\admin\AppData\Local\Google\Desktop\Install\{6c5bc945-ecdc-d004-f972-a3d5e5911bb1}\❤≸⋙\Ⱒ☠⍨\‮ﯹ๛\{6c5bc945-ecdc-d004-f972-a3d5e5911bb1}\GoogleUpdate.exeexecutable
MD5:EA039A854D20D7734C5ADD48F1A51C34
SHA256:69E966E730557FDE8FD84317CDEF1ECE00A8BB3470C0B58F3231E170168AF169
188InstallFlashPlayer.exeC:\Program Files\Google\Desktop\Install\{6c5bc945-ecdc-d004-f972-a3d5e5911bb1}\ \...\‮ﯹ๛\{6c5bc945-ecdc-d004-f972-a3d5e5911bb1}\@binary
MD5:C9B54AD29D5DBF646D06473785245FC8
SHA256:09736BC3FDC9B768EF4D00E48DF403BA9F96BC43B7FA8F701CDD6818CA8AF26E
188InstallFlashPlayer.exeC:\Program Files\Google\Desktop\Install\{6c5bc945-ecdc-d004-f972-a3d5e5911bb1}\ \...\‮ﯹ๛\{6c5bc945-ecdc-d004-f972-a3d5e5911bb1}\GoogleUpdate.exeexecutable
MD5:EA039A854D20D7734C5ADD48F1A51C34
SHA256:69E966E730557FDE8FD84317CDEF1ECE00A8BB3470C0B58F3231E170168AF169
468services.exeC:\Windows\assembly\GAC\Desktop.iniexecutable
MD5:D1A909DB8D6F6A6DA32050F077BE630C
SHA256:315387A3E83AAE9A667B82635B26A4D8576887887732239422D63E0F964CA17B
116invoice_2318362983713_823931342io.pdf.exeC:\Users\admin\AppData\Local\Temp\InstallFlashPlayer.exeexecutable
MD5:2FF9B590342C62748885D459D082295F
SHA256:672EC8DCEAFD429C1A09CFAFBC4951968953E2081E0D97243040DB16EDB24429
188InstallFlashPlayer.exeC:\Windows\System32\Macromed\Flash\FlashInstall.logtext
MD5:CE8D14D475F2C078790C44F6B1CA45A2
SHA256:96772CE2F2F397A94A7B798A81B2DD9CFD487C8669089BD808A61A6AB069AEF1
116invoice_2318362983713_823931342io.pdf.exeC:\Users\admin\AppData\Local\Temp\msimg32.dllexecutable
MD5:E051308C2F0C1B280514C99AABD36E34
SHA256:DDF7CCAB32E8C0EE6294DF2591EFAC632C27C61D073B86B97DE62311F9379212
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
228
DNS requests
3
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
404
104.102.58.45:80
http://fpdownload.macromedia.com/get/flashplayer/update/current/install/install_all_win_cab_ax_sgn.z
unknown
—
—
whitelisted
116
invoice_2318362983713_823931342io.pdf.exe
GET
404
49.13.77.253:80
http://j.maxmind.com/app/geoip.js
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1108
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
116
invoice_2318362983713_823931342io.pdf.exe
85.114.128.127:53
—
—
—
malicious
116
invoice_2318362983713_823931342io.pdf.exe
49.13.77.253:80
j.maxmind.com
Hetzner Online GmbH
DE
shared
188
InstallFlashPlayer.exe
85.114.128.127:53
—
—
—
malicious
—
—
85.114.128.127:53
—
—
—
malicious
—
—
104.102.58.45:80
fpdownload.macromedia.com
AKAMAI-AS
DE
whitelisted
—
—
207.191.243.130:16471
—
—
—
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
j.maxmind.com
  • 49.13.77.253
shared
fpdownload.macromedia.com
  • 104.102.58.45
whitelisted

Threats

PID
Process
Class
Message
116
invoice_2318362983713_823931342io.pdf.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
116
invoice_2318362983713_823931342io.pdf.exe
Potential Corporate Privacy Violation
ET POLICY Maxmind geoip check to /app/geoip.js
116
invoice_2318362983713_823931342io.pdf.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
116
invoice_2318362983713_823931342io.pdf.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
116
invoice_2318362983713_823931342io.pdf.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
116
invoice_2318362983713_823931342io.pdf.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
116
invoice_2318362983713_823931342io.pdf.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
116
invoice_2318362983713_823931342io.pdf.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
116
invoice_2318362983713_823931342io.pdf.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
188
InstallFlashPlayer.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
invoice_2318362983713_823931342io.pdf.exe